CVE-2022-26982 - CVE House
Back to Database
Status published High CVE-2022-26982

SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute...

Vulnerability Description

SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php code because the themes can be modified by an administrator. NOTE: the vendor's position is that administrators are intended to have the ability to modify themes, and can thus choose any PHP code that they wish to have executed on the server.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-26982

Credits & Attribution

No credits recorded in the NVD database.

References

More from simplemachines

View All →
CVE-2019-12490
An issue was discovered in Simple Machines Forum (SMF) before...
Medium 6.5
CVE-2019-11574
An issue was discovered in Simple Machines Forum (SMF) before...
Critical 9.8
CVE-2018-10305
The MessageSearch2 function in PersonalMessage.php in Simple Machines Forum (SMF)...
Critical 9.8
CVE-2016-5727
LogInOut.php in Simple Machines Forum (SMF) 2.1 allows remote attackers...
High 8.8
CVE-2016-5726
Packages.php in Simple Machines Forum (SMF) 2.1 allows remote attackers...
Critical 9.8

Affected Vendor

simplemachines

View all reports →

Affected Software

simple machines forum
Vulnerable Versions:
0

Timeline

Official Publish: April 5th, 2022
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.